David Evans, profile picture
Uploaded byDavid Evans
PPTX, PDF1,149 views

Engineering Cryptographic Applications: Using (and Misusing) Symmetric Ciphers

This document discusses using symmetric encryption for applications beyond simple transmission of encrypted messages. It covers generating cryptographically secure random keys, using block cipher modes like CBC and CTR to encrypt files, and securely storing encryption keys and initialization vectors. Generating true randomness is impossible, so physical sources must be amplified with cryptographic pseudorandom number generators. Commonly used block cipher modes like ECB leak information, while CBC and CTR avoid this if properly implemented with random or changing nonces/IVs. Storing keys securely, such as encrypting them with a password-derived key, is also important for practical encrypted storage systems.

Embed presentation

Downloaded 17 times
Stephen Kleene
Engineering Cryptographic Applications Day 2: Using (and Misusing) Symmetric Ciphers David Evans University of Virginia www.cs.virginia.edu/evans Microstrategy Course 11 October 2013
Recap: Symmetric Encryption Ciphertext Plaintext AES AES Plaintext Insecure Channel Key Key Correctness property: for all possible messages m, D(E(m)) = m Security property: given c  E(m), it is “hard” to learn anything interesting about m. “hard” = if correctly implemented and used, even the NSA can’t do it unless they have made dozens of theoretical breakthroughs or have energy comparable to Trillions of massive nuclear explosions evans@virginia.edu Engineering Crypto Applications 2
Today: Using Symmetric Encryption Ciphertext Plaintext AES AES Plaintext Insecure Channel Key evans@virginia.edu Key Engineering Crypto Applications 3
Today: Using Symmetric Encryption Ciphertext Plaintext AES AES Plaintext Insecure Channel Key Key 1. How to generate a good (unpredictable) key: randomness 2. How to use symmetric encryption to do more interesting things than just send one block: building an encrypted file server evans@virginia.edu Engineering Crypto Applications 4
Generating Randomness evans@virginia.edu Engineering Crypto Applications 5
0101100001111 0101101001101 0110000111011 0110000111011 1010000000011 1010100010011 1011000000011 1011000100011 1011011001011 1011011001011 1110011011110 0110011011010 0100000111000 0100100111001 Which is random? 0001110111000 0001110111001 0000111010100 0000111010100 1000101000001 1000101010001 evans@virginia.edu Engineering Crypto Applications 6
0101100001111 0101101001101 0110000111011 0110000111011 1010000000011 1010100010011 1011000000011 C1 with sequences of 5 or more 1011000100011 C1 from Puzzle Challenge repeated symbols modified (message Crypto.Random) 1011011001011 1011011001011 1110011011110 0110011011010 0100000111000 0100100111001 0001110111000 random? Which is 0001110111001 0000111010100 0000111010100 1000101000001 1000101010001 evans@virginia.edu Engineering Crypto Applications 7
Which is random? Source of images: http://boallen.com/random-numbers.html evans@virginia.edu Engineering Crypto Applications 8
Which is random? random.org PHP rand() (atmospheric noise) (on Windows) Which should you use to generate cyrptographic keys? Source of images: http://boallen.com/random-numbers.html evans@virginia.edu Engineering Crypto Applications 9
Defining Non-Randomness If you can find any predictable patterns in the sequence, it is definitely not random. evans@virginia.edu I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description; and perhaps I could never succeed in intelligibly doing so. But I know it when I see it, and the motion picture involved in this case is not that. Supreme Court Justice Potter Stewart (or pornography) Engineering Crypto Applications 10
Defining Randomness й ров Andrey Kolmogorov (1903-1987) For a sequence s, its Kolmogorov Complexity K(s) = the length of the shortest description of s A sequence s is random, if K(s) = |s| + C (This is a somewhat informal version. A real definition would need to be more careful about stating this asymptotically.) evans@virginia.edu Engineering Crypto Applications “He was to probability theory what Euclid was to geometry.” (Peter Lax) 11
Kolmogorov Complexities s = 000000000000000… evans@virginia.edu Engineering Crypto Applications 12
Kolmogorov Complexities s = 000000000000000… description = “N repeated 0s” K(s) = log |s| + C1 < |s| + C t = 010011000111000011110000011111… evans@virginia.edu Engineering Crypto Applications 13
Kolmogorov Complexities s = 000000000000000… description = “N repeated 0s” K(s) = log |s| + C1 < |s| + C t = 010011000111000011110000011111… description = “t = “”; int for (i = 1; for (j = for (j = i, j; i < N; i++) { 0; j < i; j++) t += „0‟; 0; j < i; j++) t += „1‟; }” K(s) = log |s| + C1 < |s| + C evans@virginia.edu Engineering Crypto Applications 14
Kolmogorov Complexities r=010110000111101100001110111010000000011101 100000001110110110010111110011011110010000011 100000011101110000000111010100100010100000101 000010011101110111111110011000101… "from Crypto.Random import random def random_sequence(n): return map(lambda x: random.choice([0, 1]), range(n)) " and state of random module (and any entropy added during generation) Hmmm…maybe answer from earlier slide was wrong! evans@virginia.edu Engineering Crypto Applications 15
If your mind isn’t blown yet… What is the smallest natural number that cannot be described in eleven words? evans@virginia.edu Engineering Crypto Applications 16
If your mind isn’t blown yet… What is the smallest natural number that cannot be described in eleven words? 1 2 3 4 5 The smallest natural number that 6 7 8 9 10 11 cannot be described in eleven words. evans@virginia.edu Engineering Crypto Applications 17
Randomness is Essential • Kolmogorov provides a definition of randomness but not a “useful” one: computing K(s) for an arbitrary s is undecidable (not just hard, theoretically impossible) • Impossible for a program to generate true randomness: program can generate longer sequence than itself • There are physical sources of randomness (or near randomness): quantum events, radioactive decay, thermal noise, lava lamps, key presses evans@virginia.edu Engineering Crypto Applications 18
Amplifying Physical Randomness Pseudo-Random Number Generator k = f(physical randomness) 0 AES 1 k AES 2 3 k k output AES output output Every once in a while, compute a new k using new physical randomness. evans@virginia.edu Engineering Crypto Applications 19
NIST SP 800-90: Recommendation for Random Number Generation Using Deterministic Random Bit Generators (2006) evans@virginia.edu Engineering Crypto Applications 20
Dual-EC PRNG s0  physical randomness si +1= φ(si P) Update Internal State evans@virginia.edu P and Q are points on an elliptic curve ri = φ(si Q) si 16 least significant bits of ri’s x-coordinate Generate Output Bits Engineering Crypto Applications 21
Elliptic Curves y2 = x3 – 7 (mod p) Discrete values: x and y are integers! Addition: P + Q = intersection of curve with line through P and Q Multiplication: repeated addition kP = P + P + … + P Elliptic Curves are primarily used in asymmetric crypto – but also in Dual EC PRNG evans@virginia.edu Engineering Crypto Applications 22
Elliptic Curves P+Q y2 = x3 – 7 (mod p) Discrete values: x and y are integers! Addition: P + Q = negate intersection of curve with line through P and Q Multiplication: repeated addition kP = P + P + … + P evans@virginia.edu Engineering Crypto Applications P Q 23
Elliptic Curves Elliptic curve discrete logarithm problem: given points P and Q on an elliptic curve, it is hard to find an integer k such that Q = kP. y2 = x3 – 7 (mod p) P + Q = point on curve where line PQ intersects kP = P + P + … + P (multiplication is just repeated addition) evans@virginia.edu Engineering Crypto Applications 24
Curve Used by Dual-EC PRNG NIST P-256 y2 = x3 + ax + b (mod p) 256 − 2224 + 2192 + 296 − 1 p=2 a=p−3= b= 115792089210356248762697446949407573530086143415290314195533631308867097853948 41058363725152142129326129780047268409114441015993725554835256314039467401291 Elliptic curve operations are expensive! Dual-EC PRNG is 1000x slower than strong PRNG’s built using symmetric ciphers. evans@virginia.edu Engineering Crypto Applications 25
Why would anyone use Elliptic Curves as basis for PRNG? • Easier to plant a back-door in it than designs based on symmetric ciphers • Can be used to provide provable security properties based on number theory – But not done for Dual EC PRNG evans@virginia.edu Engineering Crypto Applications 26
Dual-EC PRNG Proposed as NIST standard (2005) s0  randomness P and Q are (random?) points on P-256. si +1= φ(si P) Update Internal State evans@virginia.edu ri = φ(si Q) si 16 least significant bits of ri’s x-coordinate Generate Output Bits Engineering Crypto Applications 27
Image credit: Matthew Green OpenSSL-FIPS Implementation (using NIST P and Q values) evans@virginia.edu Engineering Crypto Applications 28
“Rump session” talk at CRYPTO 2007: You can choose Q such that: Q = dP then, it is easy to find e such that: P = eQ and then easy to learn state of PRNG from just one output! evans@virginia.edu Engineering Crypto Applications 29
Shumow and Ferguson’s conclusion: evans@virginia.edu Engineering Crypto Applications 30
Snowden Leak (5 September 2013) 2013 Intelligence Budget Request ($250M) 2013 Intelligence Budget Request evans@virginia.edu Engineering Crypto Applications 31
September 2013 evans@virginia.edu Engineering Crypto Applications 32
evans@virginia.edu Engineering Crypto Applications 33
evans@virginia.edu Engineering Crypto Applications 34
Randomness Summary • All cryptosystems depend on randomness • No way to test is a value is really random • Physical randomness is limited: need algorithms to amplify physical randomness • If you pseudorandom numbers are predictable, all is (almost always) lost evans@virginia.edu Engineering Crypto Applications 35
Building an Encrypted File System evans@virginia.edu Engineering Crypto Applications 36
Scenario • Documents about plan to overthrow government stored on (easily-stolen) device • Password/biometric-protected (assume that works, for now) Data should not be readable to someone who steals the device and can physically extract its non-volatile (flash) storage evans@virginia.edu Engineering Crypto Applications 37
Electronic Codebook Mode block 2 AES block 3 block 4 AES block 4 block n-1 AES block n-1 block n AES block n … AES … block 1 block 3 divide into 128-bit blocks AES block 2 declaration.txt block 1 k Encrypt each block with k evans@virginia.edu Engineering Crypto Applications 38
Electronic Codebook Mode block 2 AES block 3 block 4 AES block 4 block n-1 AES block n-1 block n AES block n … AES … block 1 block 3 divide into 128-bit blocks AES block 2 declaration.txt block 1 k If two blocks have the same plaintext, with ECB they have the same ciphertext! evans@virginia.edu Engineering Crypto Applications 39
Block Size 128 bits = 16 bytes "Benjamin Frankli" (16 characters) Almanack Mail pennsylvannians.txt declaration.txt evans@virginia.edu Engineering Crypto Applications 40
Time-Space Tradeoffs No-memory brute force attack: known crib AES known ciphertext Try all keys until you find one that fits evans@virginia.edu Engineering Crypto Applications Memory: 0 Time: 2127 encryptions (1T nuclear mega-bombs) 41
Time-Space Tradeoffs No-time (not) brute force attack: key AESkey(crib) 000…000 000…001 7ebc5137da5ff2 … Pre-compute table: 4d7b9328a582c … Break intercepted ciphertext message: one table lookup! evans@virginia.edu sort by ciphertext Time: 1 Memory: 2132 bytes ~$2 Decillion (1033) Engineering Crypto Applications 42
Won’t quite work like this for AES, but with some more tricks. Combination: Rainbow Tables Precompute: known crib AES Only store these: ciphertext 1 AES … AES ciphertext 264 … … known crib AES ciphertext 1 AES … AES ciphertext 264 Time: 264 Memory: 268 bytes (~$137 Trillion) evans@virginia.edu Engineering Crypto Applications 43
16 October 2013 University of Virginia cs4414 44
NSA Meltdown? “Experts estimate the new center in Utah can store data by the exabyte or zettabyte.” (Actual amount is highly classified.) 45
Cipher Block Chaining Mode (CBC) block 2 block 3 block 4 Initialization Vector block 1 AES AES AES evans@virginia.edu AES block 1 k block 2 block 3 block 4 Engineering Crypto Applications 46
Cipher Block Chaining Mode block 2 block 3 block 4 Initialization Vector block 1 AES AES AES AES block 1 k block 2 block 3 block 4  Avoids leaking repeated plaintexts − Cannot encrypt in parallel evans@virginia.edu Engineering Crypto Applications 47
Counter Mode (CTR) Nonce 00000000 Nonce 00000001 … Counter block 1 k block 2 block 1 evans@virginia.edu AES AES k Increase counter for each block block 2 Engineering Crypto Applications 48
Counter Mode (CTR) Nonce 00000000 Nonce 00000001 … Counter AES AES k k block 1 Increase counter for each block block 2  Avoids leaking repeated plaintexts  Can encrypt and decrypt in parallel ⁇ Systematic input block 1 evans@virginia.edu block 2 Engineering Crypto Applications 49
How should our young subversive store master key k and (per-file) nonces? evans@virginia.edu Engineering Crypto Applications 50
Storing the Key (?) AES k Human-Remembered 4-Digit PIN evans@virginia.edu Engineering Crypto Applications stored encrypted k 0704 51
Maybe this could work with a tamper-proof device? evans@virginia.edu Engineering Crypto Applications 52
R2B2: $200 robot that can try all 10000 fourdigit PINs in < 20 hours evans@virginia.edu Engineering Crypto Applications 53
Higher Entropy Passwords AES k Human-Remembered Long Password evans@virginia.edu stored encrypted k (44 bits of entropy) Engineering Crypto Applications 54
Scaling Work repeat 1000 times k Human-Remembered Long Password evans@virginia.edu stored 1000x encrypted k AES (44 bits of entropy) Engineering Crypto Applications 55
repeat 1000 times k AES stored 1000x encrypted k Scaling Work (44 bits of entropy) Time for one AES: 10 ms Time for 244 AESs: 5000 years (or 2 days with 1Mx computing power) Time for 1000x AES: 10 s Time for 244 1000x AES: 5M years evans@virginia.edu Engineering Crypto Applications 56
Scaling to a Web Service evans@virginia.edu Engineering Crypto Applications 57
http://epetitions.direct.gov.uk/ evans@virginia.edu Engineering Crypto Applications 58
http://petitions.whitehouse.gov evans@virginia.edu Engineering Crypto Applications 59
Early Password Schemes UserID benf Password flyakite samadams beer tj Monti07cello04 … Login: tj Password: wahoo Failed login. Guess again. … authentication check: guess == users[userID].password evans@virginia.edu Engineering Crypto Applications 60
Early Password Schemes UserID Password benf samadams tj … FAIL Login: tj Password: wahoo beer someone who gets Failed login. Guess again. Monti07cello04 password file learns … all passwords flyakite authentication check: guess == users[userID].password evans@virginia.edu Engineering Crypto Applications 61
Encrypted Passwords Scheme UserID benf Password AESK(flyakite) samadams AESK(beer) tj AESK(Monti07cello04) … Master key K Store passwords encrypted using K … authentication check: AESK(guess) == users[userID].password evans@virginia.edu Engineering Crypto Applications 62
Encrypted Passwords Scheme UserID benf Password FAIL Master key K AES (beer) Store passwords someone who gets encrypted using K AES (Monti07cello04) password file and K … learns all passwords AESK(flyakite) samadams tj K K … authentication check: AESK(guess) == users[userID].password evans@virginia.edu Engineering Crypto Applications 63
Hashed Passwords Scheme UserID benf Password AESflyakite(0) samadams AESbeer(0) tj AESMonti07cello04(0) … Store passwords by using them as key to encrypt 0 … authentication check: AESguess(0) == users[userID].password evans@virginia.edu Engineering Crypto Applications 64
Hashed Passwords Scheme UserID benf Password AESflyakite(K) FAIL samadams AESbeer(K) tj AESMonti07cello04(K) … … Master key K Store passwords by using them to encrypt K authentication check: AESguess(K) == users[userID].password evans@virginia.edu Engineering Crypto Applications 65
“If they had consulted with anyone that knows anything about password security, this would not have happened,” said Paul Kocher, president of Cryptography Research, a San Francisco computer security firm. evans@virginia.edu Engineering Crypto Applications 66
86% of users are dumb Single ASCII character Two characters 0.5% 2% Three characters 14% Four alphabetic letters 14% Five same-case letters 21% Six lowercase letters 18% Words in dictionaries or names 15% Other (possibly good passwords) 14% (Morris/Thompson 79) evans@virginia.edu Engineering Crypto Applications 67
Dictionary Attacks Seed list All 1-4 letter words List of common (dog) names Words from dictionary (4M words, 20+ languages) Phone numbers, dates, etc. Rules for generating passwords http://www.openwall.com/john/ Combining words from seed list Inserting numbers, symbols Anything written in any popular Replacing “l” with “1”, password advice document! “ate” with “8”, etc. evans@virginia.edu Engineering Crypto Applications 68
Aside: My 3-Word Password Advice Unimportant Passwords: use “silly” (protect service, not user) Important Passwords: Write them down (but somewhat obfuscated and in a secure place) If you can memorize it, it is not secure! (unless you have a well-trained memory) evans@virginia.edu Engineering Crypto Applications 69
Making Dictionary Attacks Harder UserID benf Password AESflyakite(0) Password AESflyakite1000(0) samadams AESbeer(0) AESbeer1000 (0) tj AESMonti07cello04(0) AESMonti07cello041000(0) … … … 1. Use a more expensive cryptographic hash function evans@virginia.edu Engineering Crypto Applications 70
Making Dictionary Attacks Harder UserID Salt (16 bits) Password benf 52455 AESflyakite1000(52455) samadams 50757 AESbeer1000 (50757) AESMonti07cello041000(47101 AES x 1000 makes dictionary attack 1000 times harder ) 16-bit salt makes dictionary attack 216 times harder (but doesn’t make targeted against one user harder) … … tj 47101 2. Add “salt” – randomly selected (but non-secret) value for each user evans@virginia.edu Engineering Crypto Applications 71
Two Big Problems Remaining: 1. Users are still morons evans@virginia.edu Engineering Crypto Applications 72
Two Big Problems Remaining: 1. Users are still morons (Solving Auditors calledscope of employees and this is outside 100 IRS this class.) managers, portraying themselves as personnel from the information technology help desk trying to correct a network problem. They asked the employees to provide their network logon name and temporarily change their password to one they suggested. “We were able to convince 35 managers and employees to provide us their username and change their password,” the report said. GAO Audit of IRS (2005) evans@virginia.edu Engineering Crypto Applications 73
Two Big Problems Remaining: 2. Transmitting password Insecure Channel petitions.gov How does TJ know he’s really talking to petitions.gov? How can he establish a secure channel to transmit password? evans@virginia.edu Engineering Crypto Applications 74
Plan for Next Week Solving these problems using asymmetric cryptography: - Public key cryptosystems - Digital signatures - Public key protocols (TLS) open to requests! evans@virginia.edu MightBeEvil.com/crypto evans@virginia.edu Engineering Crypto Applications 75
evans@virginia.edu Engineering Crypto Applications 76

More Related Content

PPTX
Public-Key Protocols
byDavid Evans
 
PPTX
Cryptographic Future
byDavid Evans
 
PDF
Crack Wep Wifi Under100seconds
bymvde3000
 
PDF
Classical cipher
byHoang Nguyen
 
PPT
Anninhmang K13 Mtt
byQuynh Khuong
 
PPTX
Amanda Sopkin - Computational Randomness: Creating Chaos in an Ordered Machin...
byCodemotion
 
PPTX
Engineering Cryptographic Applications: Symmetric Encryption
byDavid Evans
 
PPTX
prg-part1 Advanced_CryptographyAdvanced_.pptx
byProFa3
 
Public-Key Protocols
byDavid Evans
 
Cryptographic Future
byDavid Evans
 
Crack Wep Wifi Under100seconds
bymvde3000
 
Classical cipher
byHoang Nguyen
 
Anninhmang K13 Mtt
byQuynh Khuong
 
Amanda Sopkin - Computational Randomness: Creating Chaos in an Ordered Machin...
byCodemotion
 
Engineering Cryptographic Applications: Symmetric Encryption
byDavid Evans
 
prg-part1 Advanced_CryptographyAdvanced_.pptx
byProFa3
 

Similar to Engineering Cryptographic Applications: Using (and Misusing) Symmetric Ciphers

PDF
l_08png.pdf
byssuserf5dd16
 
PDF
40120140502003
byIAEME Publication
 
PPTX
Introduction to Cryptography
byDavid Evans
 
PDF
J45015460
byIJERA Editor
 
PPTX
Cryptography
byDavid Evans
 
PDF
Sullivan randomness-infiltrate 2014
byCloudflare
 
PDF
Random number generators
byBob Landstrom
 
PPTX
Pseudo Random Number
byHemant Chetwani
 
PDF
Generating random primes
byJohn-André Bjørkhaug
 
PPTX
Secure coding for developers
bysluge
 
PDF
Modern Cryptography
byJames McGivern
 
PDF
Erlang, random numbers, and the security: London Erlang User Group Talk Slide...
byKenji Rikitake
 
PPTX
Cryptography using probability
byPrankit Mishra
 
PDF
Elliptic Curve Cryptography for those who are afraid of maths
byMartijn Grooten
 
PDF
CNIT 141: 2. Randomness
bySam Bowne
 
PDF
Fv2510671071
byIJERA Editor
 
PDF
Encryption Deep Dive
byDiego Pacheco
 
PPTX
Ch02 NetSec5e Network Security Essential Chapter 2.pptx
byridozulfahmi1
 
PPTX
Information and network security 30 random numbers
byVaibhav Khanna
 
PPTX
Lecture 9-Advance Cryptography-1- PRNG and Stream ciphers (1).pptx
byerricnocteam
 
l_08png.pdf
byssuserf5dd16
 
40120140502003
byIAEME Publication
 
Introduction to Cryptography
byDavid Evans
 
J45015460
byIJERA Editor
 
Cryptography
byDavid Evans
 
Sullivan randomness-infiltrate 2014
byCloudflare
 
Random number generators
byBob Landstrom
 
Pseudo Random Number
byHemant Chetwani
 
Generating random primes
byJohn-André Bjørkhaug
 
Secure coding for developers
bysluge
 
Modern Cryptography
byJames McGivern
 
Erlang, random numbers, and the security: London Erlang User Group Talk Slide...
byKenji Rikitake
 
Cryptography using probability
byPrankit Mishra
 
Elliptic Curve Cryptography for those who are afraid of maths
byMartijn Grooten
 
CNIT 141: 2. Randomness
bySam Bowne
 
Fv2510671071
byIJERA Editor
 
Encryption Deep Dive
byDiego Pacheco
 
Ch02 NetSec5e Network Security Essential Chapter 2.pptx
byridozulfahmi1
 
Information and network security 30 random numbers
byVaibhav Khanna
 
Lecture 9-Advance Cryptography-1- PRNG and Stream ciphers (1).pptx
byerricnocteam
 

More from David Evans

PPTX
Cryptocurrency Jeopardy!
byDavid Evans
 
PPTX
Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
byDavid Evans
 
PPTX
Hidden Services, Zero Knowledge
byDavid Evans
 
PPTX
Anonymity in Bitcoin
byDavid Evans
 
PPTX
Midterm Confirmations
byDavid Evans
 
PPTX
Scripting Transactions
byDavid Evans
 
PPTX
How to Live in Paradise
byDavid Evans
 
PPTX
Bitcoin Script
byDavid Evans
 
PPTX
Mining Economics
byDavid Evans
 
PPTX
Mining
byDavid Evans
 
PPTX
The Blockchain
byDavid Evans
 
PPTX
Becoming More Paranoid
byDavid Evans
 
PPTX
Asymmetric Key Signatures
byDavid Evans
 
PPTX
Class 1: What is Money?
byDavid Evans
 
PPTX
Multi-Party Computation for the Masses
byDavid Evans
 
PPTX
Proof of Reserve
byDavid Evans
 
PPTX
Silk Road
byDavid Evans
 
PPTX
Blooming Sidechains!
byDavid Evans
 
PPTX
Useful Proofs of Work, Permacoin
byDavid Evans
 
PPTX
Alternate Cryptocurrencies
byDavid Evans
 
Cryptocurrency Jeopardy!
byDavid Evans
 
Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
byDavid Evans
 
Hidden Services, Zero Knowledge
byDavid Evans
 
Anonymity in Bitcoin
byDavid Evans
 
Midterm Confirmations
byDavid Evans
 
Scripting Transactions
byDavid Evans
 
How to Live in Paradise
byDavid Evans
 
Bitcoin Script
byDavid Evans
 
Mining Economics
byDavid Evans
 
Mining
byDavid Evans
 
The Blockchain
byDavid Evans
 
Becoming More Paranoid
byDavid Evans
 
Asymmetric Key Signatures
byDavid Evans
 
Class 1: What is Money?
byDavid Evans
 
Multi-Party Computation for the Masses
byDavid Evans
 
Proof of Reserve
byDavid Evans
 
Silk Road
byDavid Evans
 
Blooming Sidechains!
byDavid Evans
 
Useful Proofs of Work, Permacoin
byDavid Evans
 
Alternate Cryptocurrencies
byDavid Evans
 

Recently uploaded

PDF
Real-Time Data Insight Using Microsoft Forms for Business
byElevate
 
PDF
How to Evaluate a High Performance Database
byScyllaDB
 
PDF
Fundamentals and Frontiers of Post Quantum Cryptography
byGokul Alex
 
PDF
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
PDF
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
PPTX
Gemini vs ChatGPT : Comparing Top AI Models
byDigicarrom
 
PPTX
How to make Ai agents using Google Gemini AI.pptx
bypkluffy111
 
PDF
Internet_of_Things_IoT_for_Next_Generation_Smart_Systems_Utilizing.pdf
byRoshanSyed12
 
PDF
WCAG Analyzer Tools and Techniques for User-Friendly Websites
byAccessibility Analyzer
 
PDF
100 Insights After the 200th Issue of NewMind AI Journal
byNewMind AI
 
PDF
Exam Prep Plan Overview: Amazon Web Services (AWS) Certified
byVICTOR MAESTRE RAMIREZ
 
PDF
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
PDF
Day 3 - Data and Application Security - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
PDF
The State of the Gen AI economy - 2025 - The Meliora Company
byClive Dickens
 
PPTX
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
PPTX
MGw_MRS Benfits seu beficios de redes 4g
byJoaquimBarros18
 
PDF
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
PDF
What Is a Private LLM and Why Enterprises Need It
byAivada
 
PPTX
Top _HR Technology Trends _for 2026_.pptx
byAutomationEdge Technologies
 
PPTX
Technology Consulting _ by Slidesgo.pptx
byfh82277
 
Real-Time Data Insight Using Microsoft Forms for Business
byElevate
 
How to Evaluate a High Performance Database
byScyllaDB
 
Fundamentals and Frontiers of Post Quantum Cryptography
byGokul Alex
 
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
Gemini vs ChatGPT : Comparing Top AI Models
byDigicarrom
 
How to make Ai agents using Google Gemini AI.pptx
bypkluffy111
 
Internet_of_Things_IoT_for_Next_Generation_Smart_Systems_Utilizing.pdf
byRoshanSyed12
 
WCAG Analyzer Tools and Techniques for User-Friendly Websites
byAccessibility Analyzer
 
100 Insights After the 200th Issue of NewMind AI Journal
byNewMind AI
 
Exam Prep Plan Overview: Amazon Web Services (AWS) Certified
byVICTOR MAESTRE RAMIREZ
 
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
Day 3 - Data and Application Security - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
The State of the Gen AI economy - 2025 - The Meliora Company
byClive Dickens
 
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
MGw_MRS Benfits seu beficios de redes 4g
byJoaquimBarros18
 
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
What Is a Private LLM and Why Enterprises Need It
byAivada
 
Top _HR Technology Trends _for 2026_.pptx
byAutomationEdge Technologies
 
Technology Consulting _ by Slidesgo.pptx
byfh82277
 

Engineering Cryptographic Applications: Using (and Misusing) Symmetric Ciphers

  • 1.
  • 2.
    Engineering Cryptographic Applications Day 2: Using (and Misusing) Symmetric Ciphers David Evans Universityof Virginia www.cs.virginia.edu/evans Microstrategy Course 11 October 2013
  • 3.
    Recap: Symmetric Encryption Ciphertext Plaintext AES AES Plaintext InsecureChannel Key Key Correctness property: for all possible messages m, D(E(m)) = m Security property: given c  E(m), it is “hard” to learn anything interesting about m. “hard” = if correctly implemented and used, even the NSA can’t do it unless they have made dozens of theoretical breakthroughs or have energy comparable to Trillions of massive nuclear explosions evans@virginia.edu Engineering Crypto Applications 2
  • 4.
    Today: Using SymmetricEncryption Ciphertext Plaintext AES AES Plaintext Insecure Channel Key evans@virginia.edu Key Engineering Crypto Applications 3
  • 5.
    Today: Using SymmetricEncryption Ciphertext Plaintext AES AES Plaintext Insecure Channel Key Key 1. How to generate a good (unpredictable) key: randomness 2. How to use symmetric encryption to do more interesting things than just send one block: building an encrypted file server evans@virginia.edu Engineering Crypto Applications 4
  • 6.
  • 7.
    0101100001111 0101101001101 0110000111011 0110000111011 10100000000111010100010011 1011000000011 1011000100011 1011011001011 1011011001011 1110011011110 0110011011010 0100000111000 0100100111001 Which is random? 0001110111000 0001110111001 0000111010100 0000111010100 1000101000001 1000101010001 evans@virginia.edu Engineering Crypto Applications 6
  • 8.
    0101100001111 0101101001101 0110000111011 0110000111011 10100000000111010100010011 1011000000011 C1 with sequences of 5 or more 1011000100011 C1 from Puzzle Challenge repeated symbols modified (message Crypto.Random) 1011011001011 1011011001011 1110011011110 0110011011010 0100000111000 0100100111001 0001110111000 random? Which is 0001110111001 0000111010100 0000111010100 1000101000001 1000101010001 evans@virginia.edu Engineering Crypto Applications 7
  • 9.
    Which is random? Sourceof images: http://boallen.com/random-numbers.html evans@virginia.edu Engineering Crypto Applications 8
  • 10.
    Which is random? random.org PHPrand() (atmospheric noise) (on Windows) Which should you use to generate cyrptographic keys? Source of images: http://boallen.com/random-numbers.html evans@virginia.edu Engineering Crypto Applications 9
  • 11.
    Defining Non-Randomness If youcan find any predictable patterns in the sequence, it is definitely not random. evans@virginia.edu I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description; and perhaps I could never succeed in intelligibly doing so. But I know it when I see it, and the motion picture involved in this case is not that. Supreme Court Justice Potter Stewart (or pornography) Engineering Crypto Applications 10
  • 12.
    Defining Randomness й ров Andrey Kolmogorov (1903-1987) For asequence s, its Kolmogorov Complexity K(s) = the length of the shortest description of s A sequence s is random, if K(s) = |s| + C (This is a somewhat informal version. A real definition would need to be more careful about stating this asymptotically.) evans@virginia.edu Engineering Crypto Applications “He was to probability theory what Euclid was to geometry.” (Peter Lax) 11
  • 13.
    Kolmogorov Complexities s =000000000000000… evans@virginia.edu Engineering Crypto Applications 12
  • 14.
    Kolmogorov Complexities s =000000000000000… description = “N repeated 0s” K(s) = log |s| + C1 < |s| + C t = 010011000111000011110000011111… evans@virginia.edu Engineering Crypto Applications 13
  • 15.
    Kolmogorov Complexities s =000000000000000… description = “N repeated 0s” K(s) = log |s| + C1 < |s| + C t = 010011000111000011110000011111… description = “t = “”; int for (i = 1; for (j = for (j = i, j; i < N; i++) { 0; j < i; j++) t += „0‟; 0; j < i; j++) t += „1‟; }” K(s) = log |s| + C1 < |s| + C evans@virginia.edu Engineering Crypto Applications 14
  • 16.
    Kolmogorov Complexities r=010110000111101100001110111010000000011101 100000001110110110010111110011011110010000011 100000011101110000000111010100100010100000101 000010011101110111111110011000101… "from Crypto.Randomimport random def random_sequence(n): return map(lambda x: random.choice([0, 1]), range(n)) " and state of random module (and any entropy added during generation) Hmmm…maybe answer from earlier slide was wrong! evans@virginia.edu Engineering Crypto Applications 15
  • 17.
    If your mindisn’t blown yet… What is the smallest natural number that cannot be described in eleven words? evans@virginia.edu Engineering Crypto Applications 16
  • 18.
    If your mindisn’t blown yet… What is the smallest natural number that cannot be described in eleven words? 1 2 3 4 5 The smallest natural number that 6 7 8 9 10 11 cannot be described in eleven words. evans@virginia.edu Engineering Crypto Applications 17
  • 19.
    Randomness is Essential •Kolmogorov provides a definition of randomness but not a “useful” one: computing K(s) for an arbitrary s is undecidable (not just hard, theoretically impossible) • Impossible for a program to generate true randomness: program can generate longer sequence than itself • There are physical sources of randomness (or near randomness): quantum events, radioactive decay, thermal noise, lava lamps, key presses evans@virginia.edu Engineering Crypto Applications 18
  • 20.
    Amplifying Physical Randomness Pseudo-RandomNumber Generator k = f(physical randomness) 0 AES 1 k AES 2 3 k k output AES output output Every once in a while, compute a new k using new physical randomness. evans@virginia.edu Engineering Crypto Applications 19
  • 21.
    NIST SP 800-90:Recommendation for Random Number Generation Using Deterministic Random Bit Generators (2006) evans@virginia.edu Engineering Crypto Applications 20
  • 22.
    Dual-EC PRNG s0 physical randomness si +1= φ(si P) Update Internal State evans@virginia.edu P and Q are points on an elliptic curve ri = φ(si Q) si 16 least significant bits of ri’s x-coordinate Generate Output Bits Engineering Crypto Applications 21
  • 23.
    Elliptic Curves y2 =x3 – 7 (mod p) Discrete values: x and y are integers! Addition: P + Q = intersection of curve with line through P and Q Multiplication: repeated addition kP = P + P + … + P Elliptic Curves are primarily used in asymmetric crypto – but also in Dual EC PRNG evans@virginia.edu Engineering Crypto Applications 22
  • 24.
    Elliptic Curves P+Q y2 =x3 – 7 (mod p) Discrete values: x and y are integers! Addition: P + Q = negate intersection of curve with line through P and Q Multiplication: repeated addition kP = P + P + … + P evans@virginia.edu Engineering Crypto Applications P Q 23
  • 25.
    Elliptic Curves Elliptic curvediscrete logarithm problem: given points P and Q on an elliptic curve, it is hard to find an integer k such that Q = kP. y2 = x3 – 7 (mod p) P + Q = point on curve where line PQ intersects kP = P + P + … + P (multiplication is just repeated addition) evans@virginia.edu Engineering Crypto Applications 24
  • 26.
    Curve Used byDual-EC PRNG NIST P-256 y2 = x3 + ax + b (mod p) 256 − 2224 + 2192 + 296 − 1 p=2 a=p−3= b= 115792089210356248762697446949407573530086143415290314195533631308867097853948 41058363725152142129326129780047268409114441015993725554835256314039467401291 Elliptic curve operations are expensive! Dual-EC PRNG is 1000x slower than strong PRNG’s built using symmetric ciphers. evans@virginia.edu Engineering Crypto Applications 25
  • 27.
    Why would anyoneuse Elliptic Curves as basis for PRNG? • Easier to plant a back-door in it than designs based on symmetric ciphers • Can be used to provide provable security properties based on number theory – But not done for Dual EC PRNG evans@virginia.edu Engineering Crypto Applications 26
  • 28.
    Dual-EC PRNG Proposed asNIST standard (2005) s0  randomness P and Q are (random?) points on P-256. si +1= φ(si P) Update Internal State evans@virginia.edu ri = φ(si Q) si 16 least significant bits of ri’s x-coordinate Generate Output Bits Engineering Crypto Applications 27
  • 29.
    Image credit: MatthewGreen OpenSSL-FIPS Implementation (using NIST P and Q values) evans@virginia.edu Engineering Crypto Applications 28
  • 30.
    “Rump session” talkat CRYPTO 2007: You can choose Q such that: Q = dP then, it is easy to find e such that: P = eQ and then easy to learn state of PRNG from just one output! evans@virginia.edu Engineering Crypto Applications 29
  • 31.
    Shumow and Ferguson’sconclusion: evans@virginia.edu Engineering Crypto Applications 30
  • 32.
    Snowden Leak (5September 2013) 2013 Intelligence Budget Request ($250M) 2013 Intelligence Budget Request evans@virginia.edu Engineering Crypto Applications 31
  • 33.
  • 34.
  • 35.
  • 36.
    Randomness Summary • Allcryptosystems depend on randomness • No way to test is a value is really random • Physical randomness is limited: need algorithms to amplify physical randomness • If you pseudorandom numbers are predictable, all is (almost always) lost evans@virginia.edu Engineering Crypto Applications 35
  • 37.
  • 38.
    Scenario • Documents aboutplan to overthrow government stored on (easily-stolen) device • Password/biometric-protected (assume that works, for now) Data should not be readable to someone who steals the device and can physically extract its non-volatile (flash) storage evans@virginia.edu Engineering Crypto Applications 37
  • 39.
    Electronic Codebook Mode block2 AES block 3 block 4 AES block 4 block n-1 AES block n-1 block n AES block n … AES … block 1 block 3 divide into 128-bit blocks AES block 2 declaration.txt block 1 k Encrypt each block with k evans@virginia.edu Engineering Crypto Applications 38
  • 40.
    Electronic Codebook Mode block2 AES block 3 block 4 AES block 4 block n-1 AES block n-1 block n AES block n … AES … block 1 block 3 divide into 128-bit blocks AES block 2 declaration.txt block 1 k If two blocks have the same plaintext, with ECB they have the same ciphertext! evans@virginia.edu Engineering Crypto Applications 39
  • 41.
    Block Size 128 bits= 16 bytes "Benjamin Frankli" (16 characters) Almanack Mail pennsylvannians.txt declaration.txt evans@virginia.edu Engineering Crypto Applications 40
  • 42.
    Time-Space Tradeoffs No-memory bruteforce attack: known crib AES known ciphertext Try all keys until you find one that fits evans@virginia.edu Engineering Crypto Applications Memory: 0 Time: 2127 encryptions (1T nuclear mega-bombs) 41
  • 43.
    Time-Space Tradeoffs No-time (not)brute force attack: key AESkey(crib) 000…000 000…001 7ebc5137da5ff2 … Pre-compute table: 4d7b9328a582c … Break intercepted ciphertext message: one table lookup! evans@virginia.edu sort by ciphertext Time: 1 Memory: 2132 bytes ~$2 Decillion (1033) Engineering Crypto Applications 42
  • 44.
    Won’t quite worklike this for AES, but with some more tricks. Combination: Rainbow Tables Precompute: known crib AES Only store these: ciphertext 1 AES … AES ciphertext 264 … … known crib AES ciphertext 1 AES … AES ciphertext 264 Time: 264 Memory: 268 bytes (~$137 Trillion) evans@virginia.edu Engineering Crypto Applications 43
  • 45.
    16 October 2013 Universityof Virginia cs4414 44
  • 46.
    NSA Meltdown? “Experts estimate the newcenter in Utah can store data by the exabyte or zettabyte.” (Actual amount is highly classified.) 45
  • 47.
    Cipher Block ChainingMode (CBC) block 2 block 3 block 4 Initialization Vector block 1 AES AES AES evans@virginia.edu AES block 1 k block 2 block 3 block 4 Engineering Crypto Applications 46
  • 48.
    Cipher Block ChainingMode block 2 block 3 block 4 Initialization Vector block 1 AES AES AES AES block 1 k block 2 block 3 block 4  Avoids leaking repeated plaintexts − Cannot encrypt in parallel evans@virginia.edu Engineering Crypto Applications 47
  • 49.
    Counter Mode (CTR) Nonce 00000000 Nonce 00000001 … Counter block1 k block 2 block 1 evans@virginia.edu AES AES k Increase counter for each block block 2 Engineering Crypto Applications 48
  • 50.
    Counter Mode (CTR) Nonce 00000000 Nonce 00000001 … Counter AES AES k k block1 Increase counter for each block block 2  Avoids leaking repeated plaintexts  Can encrypt and decrypt in parallel ⁇ Systematic input block 1 evans@virginia.edu block 2 Engineering Crypto Applications 49
  • 51.
    How should our young subversive storemaster key k and (per-file) nonces? evans@virginia.edu Engineering Crypto Applications 50
  • 52.
    Storing the Key(?) AES k Human-Remembered 4-Digit PIN evans@virginia.edu Engineering Crypto Applications stored encrypted k 0704 51
  • 53.
    Maybe this could workwith a tamper-proof device? evans@virginia.edu Engineering Crypto Applications 52
  • 54.
    R2B2: $200 robotthat can try all 10000 fourdigit PINs in < 20 hours evans@virginia.edu Engineering Crypto Applications 53
  • 55.
    Higher Entropy Passwords AES k Human-Remembered LongPassword evans@virginia.edu stored encrypted k (44 bits of entropy) Engineering Crypto Applications 54
  • 56.
    Scaling Work repeat 1000times k Human-Remembered Long Password evans@virginia.edu stored 1000x encrypted k AES (44 bits of entropy) Engineering Crypto Applications 55
  • 57.
    repeat 1000 times k AES stored 1000x encrypted k ScalingWork (44 bits of entropy) Time for one AES: 10 ms Time for 244 AESs: 5000 years (or 2 days with 1Mx computing power) Time for 1000x AES: 10 s Time for 244 1000x AES: 5M years evans@virginia.edu Engineering Crypto Applications 56
  • 58.
    Scaling to aWeb Service evans@virginia.edu Engineering Crypto Applications 57
  • 59.
  • 60.
  • 61.
    Early Password Schemes UserID benf Password flyakite samadamsbeer tj Monti07cello04 … Login: tj Password: wahoo Failed login. Guess again. … authentication check: guess == users[userID].password evans@virginia.edu Engineering Crypto Applications 60
  • 62.
    Early Password Schemes UserID Password benf samadams tj … FAILLogin: tj Password: wahoo beer someone who gets Failed login. Guess again. Monti07cello04 password file learns … all passwords flyakite authentication check: guess == users[userID].password evans@virginia.edu Engineering Crypto Applications 61
  • 63.
    Encrypted Passwords Scheme UserID benf Password AESK(flyakite) samadamsAESK(beer) tj AESK(Monti07cello04) … Master key K Store passwords encrypted using K … authentication check: AESK(guess) == users[userID].password evans@virginia.edu Engineering Crypto Applications 62
  • 64.
    Encrypted Passwords Scheme UserID benf Password FAILMaster key K AES (beer) Store passwords someone who gets encrypted using K AES (Monti07cello04) password file and K … learns all passwords AESK(flyakite) samadams tj K K … authentication check: AESK(guess) == users[userID].password evans@virginia.edu Engineering Crypto Applications 63
  • 65.
    Hashed Passwords Scheme UserID benf Password AESflyakite(0) samadamsAESbeer(0) tj AESMonti07cello04(0) … Store passwords by using them as key to encrypt 0 … authentication check: AESguess(0) == users[userID].password evans@virginia.edu Engineering Crypto Applications 64
  • 66.
    Hashed Passwords Scheme UserID benf Password AESflyakite(K) FAIL samadamsAESbeer(K) tj AESMonti07cello04(K) … … Master key K Store passwords by using them to encrypt K authentication check: AESguess(K) == users[userID].password evans@virginia.edu Engineering Crypto Applications 65
  • 67.
    “If they hadconsulted with anyone that knows anything about password security, this would not have happened,” said Paul Kocher, president of Cryptography Research, a San Francisco computer security firm. evans@virginia.edu Engineering Crypto Applications 66
  • 68.
    86% of usersare dumb Single ASCII character Two characters 0.5% 2% Three characters 14% Four alphabetic letters 14% Five same-case letters 21% Six lowercase letters 18% Words in dictionaries or names 15% Other (possibly good passwords) 14% (Morris/Thompson 79) evans@virginia.edu Engineering Crypto Applications 67
  • 69.
    Dictionary Attacks Seed list All1-4 letter words List of common (dog) names Words from dictionary (4M words, 20+ languages) Phone numbers, dates, etc. Rules for generating passwords http://www.openwall.com/john/ Combining words from seed list Inserting numbers, symbols Anything written in any popular Replacing “l” with “1”, password advice document! “ate” with “8”, etc. evans@virginia.edu Engineering Crypto Applications 68
  • 70.
    Aside: My 3-WordPassword Advice Unimportant Passwords: use “silly” (protect service, not user) Important Passwords: Write them down (but somewhat obfuscated and in a secure place) If you can memorize it, it is not secure! (unless you have a well-trained memory) evans@virginia.edu Engineering Crypto Applications 69
  • 71.
    Making Dictionary AttacksHarder UserID benf Password AESflyakite(0) Password AESflyakite1000(0) samadams AESbeer(0) AESbeer1000 (0) tj AESMonti07cello04(0) AESMonti07cello041000(0) … … … 1. Use a more expensive cryptographic hash function evans@virginia.edu Engineering Crypto Applications 70
  • 72.
    Making Dictionary AttacksHarder UserID Salt (16 bits) Password benf 52455 AESflyakite1000(52455) samadams 50757 AESbeer1000 (50757) AESMonti07cello041000(47101 AES x 1000 makes dictionary attack 1000 times harder ) 16-bit salt makes dictionary attack 216 times harder (but doesn’t make targeted against one user harder) … … tj 47101 2. Add “salt” – randomly selected (but non-secret) value for each user evans@virginia.edu Engineering Crypto Applications 71
  • 73.
    Two Big ProblemsRemaining: 1. Users are still morons evans@virginia.edu Engineering Crypto Applications 72
  • 74.
    Two Big ProblemsRemaining: 1. Users are still morons (Solving Auditors calledscope of employees and this is outside 100 IRS this class.) managers, portraying themselves as personnel from the information technology help desk trying to correct a network problem. They asked the employees to provide their network logon name and temporarily change their password to one they suggested. “We were able to convince 35 managers and employees to provide us their username and change their password,” the report said. GAO Audit of IRS (2005) evans@virginia.edu Engineering Crypto Applications 73
  • 75.
    Two Big ProblemsRemaining: 2. Transmitting password Insecure Channel petitions.gov How does TJ know he’s really talking to petitions.gov? How can he establish a secure channel to transmit password? evans@virginia.edu Engineering Crypto Applications 74
  • 76.
    Plan for NextWeek Solving these problems using asymmetric cryptography: - Public key cryptosystems - Digital signatures - Public key protocols (TLS) open to requests! evans@virginia.edu MightBeEvil.com/crypto evans@virginia.edu Engineering Crypto Applications 75
  • 77.